BNDCU: Check Upper Bound (Inverted)

For information about interpreting this page, see the help page.
Opcode and MnemonicEncoding16 bit Mode32 bit Mode64 bit ModeCPUID Feature FlagDescription
F2 0F 1A /r
BNDCU bnd, r/m32
RMValidValidNot EncodableMPXThrows a #BR exception if the address in r/m32 is greater than the upper bound in the 1's complemented version of bnd.
F2 0F 1A /r
BNDCU bnd, r/m64
RMNot EncodableNot EncodableValidMPXThrows a #BR exception if the address in r/m64 is greater than the upper bound in the 1's complemented version of bnd.

Encoding

EncodingOperand 1Operand 2
RMModRM.reg[r]ModRM.r/m[r]

Description

The BNDCU instruction compares the address in the second source operand (a GPR or memory location) against the upper bound (UB) in the 1's complemented version of the first source operand (a bound register). If the second source operand is greater, a #BR exception is thrown, and BNDSTATUS is set to 1h.

This instruction is similar to the BNDCN (Check Upper Bound) instruction, except this one inverts the bound register (i.e. finds the one's complemented form) before comparison. Generally, this instruction is the one that would be used (not BNDCN). This is because the upper bound is actually stored in inverted (1's complement) form, so any comparisons against it should have it inverted first.

If the second source operand is a general purpose register, the value contained in it is treated as the address to compare against. If, however, it is a memory location, the effective address is calculated (see LEA) and used in the comparison. At no time is memory accessed, and the flags are untouched.

Which instruction form (32 or 64 bit) is used depends on the operating mode of the processor. In 16 and 32 bit mode, the 32 bit form is used, and, in 64 bit mode, the 64 bit form is used. If a memory address is used as the second source operand, this distinction is irrelevant.

Operation

This pseudo-code uses C# syntax. A list of the types used is available here.
public void BNDCU(Bound bnd, IntPtr addr)
{
  if (addr < ~bnd.upper)
  {
    BNDSTATUS = 0x01;
    #BR;
  }
}

C Intrinsics

Exceptions

Protected Mode

#BR
If the upper bounds check fails.
#UD
If the LOCK prefix is used.
If ModRM.r/m does not encode BND0 through BND3 (i.e. contains a 4, 5, 6, or 7).
If the address size overload prefix (67h) is used when CS.D is 1.
If the address size overload prefix is not used when CS.D is 0.

Real-Address Mode

#BR
If the upper bounds check fails.
#UD
If the LOCK prefix is used.
If ModRM.r/m does not encode BND0 through BND3 (i.e. contains a 4, 5, 6, or 7).
If 16 bit addressing is used.

Virtual-8086 Mode

Same exceptions as real mode.

Compatibility Mode

Same exceptions as protected mode.

Long Mode

#BR
If the upper bounds check fails.
#UD
If the LOCK prefix is used.
If ModRM.r/m does not encode BND0 through BND3 (i.e. contains any of 4 through 15).
If the address size overload prefix (67h) is used when CS.D is 1.
If the address size overload prefix is not used when CS.D is 0.

Manual Changes

This is a list of changes that have been made from the Intel® 64 and IA-32 Architectures Software Developer’s Manual. These changes were against version 73 (dated ).

  • The overview table only mentions 32 and 64 bit mode support. However, this instruction is supported in all modes.
  • The "Encoding" section incorrectly lists the first operand (the bound register) as being written to. It is actually only read.